WOTRAPrivacy Policy
Effective 29 October 2026
This policy explains what the WOTRA app and its servers collect, why, who else handles it, and how you can see, correct or delete it. WOTRA is a strength training log; it does not show ads and does not sell or rent your data.
Who we are
WOTRA is operated by Bedirhan Sarıçayır, an individual developer in Türkiye ("we"), who is the data controller for your personal data. For anything about your data, write to [email protected].
What we collect
If you use WOTRA as a guest
Everything you enter stays on your device. Nothing is sent to our servers.
If you sign in
| Data | Where it comes from | What it is for |
|---|---|---|
| Email address, name and profile picture | Google or Apple, when you sign in with them | Creating and identifying your account |
| Display name, gender (optional) and a profile photo you upload | You | Your profile |
| Training profile: experience level, goal, training days per week, session length | You, during onboarding | Building your programme |
| Workouts, sets, weights, repetitions, notes, templates, programmes and body weight entries | You | Keeping your training in sync across your devices |
| Subscription status (product, period, renewal and expiry dates) | The app store, through RevenueCat | Unlocking premium features |
| IP address, time and route of each request | Your device, automatically | Security, abuse prevention and troubleshooting |
We never receive your payment card details: purchases are handled entirely by Google Play or the App Store.
Body weight and your training history describe your body and habits. We use them only to show them back to you and to sync them between your devices.
What we do not collect
No advertising identifiers, no location, no contacts, and no analytics or tracking SDKs from third parties.
Who else handles your data
We use a small number of service providers, each only for the purpose listed:
- OVH Hosting Inc., Canada: runs our servers and database. Your account and training data are stored in its data centre in Canada.
- Cloudflare: sits in front of our website and servers, protecting them from attacks and encrypting traffic. Every request passes through it.
- Google and Apple: sign-in, and in-app purchases through Google Play and the App Store.
- RevenueCat: processes subscription receipts and tells us whether your subscription is active. It receives purchase details and an identifier tied to your account.
- jsDelivr: the content network the app downloads exercise pictures and animations from. It sees your device's IP address when you open an exercise.
Transfers outside Türkiye and the EU
Our servers are in Canada, and Google, Apple, RevenueCat, Cloudflare and jsDelivr process data in the United States and other countries. Your data is therefore transferred outside Türkiye and the European Union, only to provide the service. When you sign in, you consent to this transfer; you can withdraw it by deleting your account.
We share data with authorities only when the law requires it.
Why we may process it
- To provide the service you signed up for: your account, sync and programmes.
- Our legitimate interest in keeping the service secure and working: request logs and rate limits.
- To deliver what you bought: subscription status.
- Your consent, where you choose to give optional information such as gender or a profile photo. You can remove it at any time.
How long we keep it
- Account data: until you delete your account.
- Backups: database backups are kept for 14 days, so deleted data disappears from them within 14 days.
- Request logs: rotated automatically and kept only briefly.
Your rights
You can ask us for a copy of your data, to correct it, or to delete it. Most of it you can change in the app, and you can delete your account there yourself. See how to delete your account.
Depending on where you live, data protection law (for example the GDPR in the EU, or KVKK in Türkiye) may give you further rights, including to object to processing and to complain to your data protection authority.
Security
All traffic between the app and our servers is encrypted (HTTPS). Access to the servers and the database is restricted.
Children
WOTRA is not intended for children under 16, and we do not knowingly collect their data.
Changes
If we change this policy, we will update the date above, and tell you in the app if the change is significant.